CVE-2022-35770: Windows NTLM Spoofing Vulnerability

CVE-2022-35770 is a spoofing vulnerability in Windows NTLM, rated Important by Microsoft, with a CVSS 3.1 base score of 6.5 (Medium). An attacker can exploit it remotely over the network, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 2.06% probability of exploitation activity in the next 30 days, higher than 82% of all scored vulnerabilities. Microsoft released the fix on 11 October 2022 in the October 2022 Patch Tuesday, delivered through 15 security updates (KB5018419, KB5018410, KB5018421, KB5018418 and more). It affects 40 products in 2 product families (Windows, ESU).

Key facts

CVE ID

CVE-2022-35770

Severity

Medium CVSS 6.5

Microsoft severity

Important

Impact

Spoofing

Exploited in the wild

No

Publicly disclosed

No

Exploitation likelihood

Less Likely

Weakness

CWE-290

EPSS

2.06% (percentile 82%)

CISA KEV

Not listed

Released

11 October 2022

Last updated

11 October 2022

Patch Tuesday

October 2022 Patch Tuesday

Product families

Windows, ESU

CVSS score and vector

Microsoft scores CVE-2022-35770 at 6.5 (temporal 5.7) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

Frequently asked questions (Microsoft)

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?

The user would have to access a malicious folder or directory. Users should never open anything that they do not know or trust to be safe.

Affected products (40)

Windows

ESU

Security updates (15)

• KB5018419 (Security Update)
• KB5018410 (Security Update)
• KB5018421 (Security Update)
• KB5018418 (Security Update)
• KB5018427 (Security Update)
• KB5018425 (Security Update)
• KB5018411 (Security Update)
• KB5018454 (Monthly Rollup)
• KB5018479 (Security Only)
• KB5018474 (Monthly Rollup)
• KB5018476 (Security Only)
• KB5018450 (Monthly Rollup)
• KB5018446 (Security Only)
• KB5018457 (Monthly Rollup)
• KB5018478 (Security Only)

NIST NVD data

NVD status

Modified

NVD CVSS

6.5 (MEDIUM)

NVD weakness

CWE-290

Published to NVD

11 October 2022

NVD last modified

17 June 2026

Affected configurations (CPE)

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35770
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-35770 (Patch, Vendor Advisory)

Acknowledgments

• RGFulw

Revision history

Related vulnerabilities

Other Windows NTLM vulnerabilities

• CVE-2026-121680: Windows NTLM Spoofing Vulnerability (High, CVSS 7.5, November 2026)
• CVE-2026-83709: Windows NTLM Elevation of Privilege Vulnerability (High, CVSS 7.8, October 2026)
• CVE-2026-50508: Windows NTLM Spoofing Vulnerability (Medium, CVSS 6.5, June 2026)
• CVE-2026-21249: Windows NTLM Spoofing Vulnerability (Low, CVSS 3.3, February 2026)
• CVE-2025-59284: Windows NTLM Spoofing Vulnerability (Low, CVSS 3.3, October 2025)
• CVE-2025-54918: Windows NTLM Elevation of Privilege Vulnerability (High, CVSS 8.8, September 2025)
• CVE-2025-53778: Windows NTLM Elevation of Privilege Vulnerability (High, CVSS 8.8, August 2025)
• CVE-2025-21217: Windows NTLM Spoofing Vulnerability (Medium, CVSS 6.5, January 2025)
• CVE-2024-30081: Windows NTLM Spoofing Vulnerability (High, CVSS 7.1, July 2024)
• CVE-2023-28225: Windows NTLM Elevation of Privilege Vulnerability (High, CVSS 7.8, April 2023)
• CVE-2023-21746: Windows NTLM Elevation of Privilege Vulnerability (High, CVSS 7.8, January 2023)
• CVE-2021-31958: Windows NTLM Elevation of Privilege Vulnerability (High, CVSS 7.5, June 2021)

More from the October 2022 Patch Tuesday

• CVE-2022-41033: Windows COM+ Event System Service Elevation of Privilege Vulnerability (High, CVSS 7.8, exploited)
• CVE-2022-37970: Windows DWM Core Library Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-37987: Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-37989: Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-37997: Windows Graphics Component Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-38028: Windows Print Spooler Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-38050: Win32k Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-38051: Windows Graphics Component Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2022-34689: Windows CryptoAPI Spoofing Vulnerability (High, CVSS 7.5)
• CVE-2022-37974: Windows Mixed Reality Developer Tools Information Disclosure Vulnerability (Medium, CVSS 6.5)
• CVE-2022-37975: Windows Group Policy Elevation of Privilege Vulnerability (High, CVSS 8.8)
• CVE-2022-37976: Active Directory Certificate Services Elevation of Privilege Vulnerability (High, CVSS 8.8)

All vulnerabilities of this release: October 2022 Patch Tuesday

Sources

• Microsoft Security Update Guide: CVE-2022-35770
• NIST NVD: CVE-2022-35770
• CVE.org record: CVE-2022-35770